6 ms·
I decided to go in and buy some I-Bonds for the first time. To do this you need to make an account with https://www.treasurydirect.gov/ https://www.treasurydire
by dgrin91 5y ago
I decided to go in and buy some I-Bonds for the first time. To do this you need to make an account with https://www.treasurydirect.gov/ https://www.treasurydirect.gov/. My god this was a shockingly bad experience filled with security theater.
* Passwords must be at least 8 chars, but can't be longer than 16 (they don't tell you the max length though
* Passwords can't have \
* Passwords are case-insensitive
* When you actually try to log in they make you use a virtual keyboard - meaning you have to use your MOUSE to click each individual character which is shown on screen in plain text. The keyboard does not work on purpose, and password manager don't work either.
From their security FAQ -
> Virtual Keyboard: The virtual keyboard is one of many security features introduced in TreasuryDirect as part of our on-going commitment to heightened password and account security. The advantage of using the virtual keyboard is that others are deterred from learning your password.
It reminds me of that video from a while back of UX designed by the devil. I know its government, but what an awful experience.
- vorpalhex 5y agoLast time I saw virtual keyboard as a security feature, it was in an early 2000s Korean MMO filled with bots...
- Macha 5y agoDublin bike hire does it, including shuffling the numbers. I could almost understand it at the terminals at bike hire points, but they do the same on their web interface. Of course the real insecurity is they assign you a fixed numeric 6 digit PIN.
- ihattendorf 5y agoYeah it's pretty bad. To enter password via keyboard/paste: right click password element -> inspect -> remove the `readonly="readonly"` attribute.
- jghn 5y agoI was surprised today, Safari autofilled the password for me. First time I tried using it with Safari.
- ethereathan 5y agoI found that it works to right-click the password field input, inspect and edit the html element, and paste my password from my password manager into the "value" property before submitting. It's still annoying, but I think it beats using their virtual keyboard.
- neogodless 5y agoYup, that or remove readonly="readonly" from the password input. Created this bookmark: javascript:(function(){document.querySelector(".pwordinput").removeAttribute("readonly")})();
- pcurve 5y agoI actually gave up because the registration failed on me multiple times, citing they're not able to verify my identity They're still using security image!! (which to this date I still don't know what it does)
- hobs 5y agoIf its the same implementation I am familiar with, its to proffer something unique to the user that they are familiar with that a phisher would likely not have, though of course, they could make a request to the provider as you as soon as you offer your username lol.
- mwint 5y agoThey told me the same thing, and then I added my driver's license number and it let me through... ... and then they sent me an email saying my account needs additional verification. They want me to fill out https://www.treasurydirect.gov/pdf/rs/acctauth.pdf https://www.treasurydirect.gov/pdf/rs/acctauth.pdf - which somehow doesn't load in the browser, but works with wget - which would require me to sign it in the presence of a "certifying officer". Yeah, jumping through all these hoops isn't worth even 10% interest on $10k.
- vehementi 5y agoWait how do they implement case insensitive passwords? Do they to_lower() it on the client?
- thfuran 5y agoBy forcing you to type using an onscreen virtual keyboard.
- mason55 5y agoPossibilities 1. They store your plaintext password and then compare to_upper() of your stored password against what you enter on the virtual keyboard (which only supports uppercase letters). 2. They to_upper() your initial password, before they salt/hash, and test the salted hash against the salted hash of whatever you type on the virtual keyboard 3. Either one of the above but with an additional to_upper() on the password you enter at login so that if you do manage to type the password using your keyboard instead of the virtual keyboard it's still case insensitive.
- missedthecue 5y agoI don't get why it's so bad. I've had to use the UK government website system for my residence visa and it was a breeze. The US department of the treasury gets $22 billion to spend every year on administration. That's $220 billion per decade. Surely they can shell out a crazy $5 million every ten years for a usable site refresh?
- christophilus 5y agoThe site looks like Sharepoint. I didn’t bother to check that it is, though. If it is, $5 mil is not enough to put a nice UI on that pig.
- kn0where 5y agoWelcome to the United States. The dysfunction is real. We spend lots of money on dumb stuff, but we can’t agree on where to spend it better.
- ffwacom 5y agoIt’s bad because i bonds aren’t a garbage product people need to be sold on.
- dangle1 5y agoYeah, when I first registered I was amazed in a bad way about the website. Then I kind of wanted to learn the history of how this was created for a guaranteed head-shaker.
- JoblessWonder 5y agoIt is so bad. So, so bad.
- stevenwoo 5y agoI have tried three browsers to get an irs.gov login and none works completely, there’s a failure on one step or another and they are using some third party login service.
- jdavis703 5y agoAre you using ad blockers, tracking protection or enhanced browser security? Consider using a stock Google Chrome installation from a desktop computer. I’m not defending the “good enough for government” mentality but merely suggesting some workarounds (FWIW it works on my computer.)
- christophilus 5y agoIt’s astonishingly bad. I right clicked the input and put my password in via the browser console. Much easier. Also, better not forget your security questions twice, or you’re going to be on the phone with an absolutely atrocious hold experience.
- quickthrower2 5y agoI am sure HNians put those security questions and answers in their password manager too.
- brewdad 5y agoI've started doing that now but when I created my TreasuryDirect account 9 years ago I wasn't doing that yet. I hope I never have to call.
- matthewaveryusa 5y agore virtual keyboards: thwarts physical keyloggers. it thwarts kernel keyloggers too, but if you have a kernel keylogger kernel mitm is also a possibility (minus bandwidth costs.) eons ago I had an hsbc card with random digits sent to me. the hsbc login asked for a random subset of the digits on the card + password which would thwart short-lived mitms — thinking back, that was pretty clever
- jamie_ca 5y agoSounds like what Canada Revenue Agency has up now as well, their 2FA setup gives you a 5x5 grid of random 3-letter combos, and when logging in they'll ask you for a specific three of them. Honestly it's a PITA (I need to keep said PDF vaguely handy, and it's stored less securely than in my password manager).
- jjoonathan 5y agoIt crashed Chrome right after I hit "submit" on the purchase. Nice! After logging in again and seeing $0.00 everywhere, I found a transaction list showing that a purchase request went through. Hopefully the amounts will update tomorrow!
- nanidin 5y agoWhen I called in to reset my password last year, they read the answers to my security questions back to me…
- jsperson 5y agoCould be worse. They used to ship you an individual physical decoder card.
- deleted 5y ago[deleted]